Introduction :- 

The Reserve Bank of India’s data localisation policy has caused a division between domestic payment companies and their global counterparts in the Indian payments scene. As many as 80 per cent players in the payment industry, including Amazon, Paytm and WhatsApp, have complied with the norms for local storage of data, with RBI's deadline of October 15.

Data Localisation Policy :-

• Data localisation is a concept that the personal data of a country’s residents should be processed and stored in that country. Some directives may restrict flow entirely, while others more leniently allow for conditional data sharing or data mirroring – in which only a copy has to be stored in the country.
• As of now, much of cross-border data transfer is governed by individual bilateral “mutual legal assistance treaties” (MLATs). The MLAT process was envisaged as a cooperation mechanism for criminal investigations by law enforcement agencies (LEAs) in exceptional circumstances. Over time, MLATs have proven to be ill-suited to handle large number of requests or provide immediate or time-bound access to critical information.
• In early April, the RBI issued a circular mandating that payment data be stored only in India by October 15. This covered everyone from Mastercard and Visa to WhatsApp Payments and PayTM.

Need of Data Localisation :-

• Digital data in India was around 40,000 petabytes in 2010; it is likely to shoot up to 2.3 million petabytes by 2020 — twice as fast as the global rate. If India houses all this data, it will become the second largest investor in the data centre market and the fifth largest data centre market by 2050.
• “Data is the new oil” provides a backbone to much of the localisation drive. In the home of the largest open Internet market in the world, companies like PhonePe claim that national wealth creation relies on in-house data storage.
• The e-commerce policy took on a similar stance, championing domestic innovation, and the data protection report also mentioned harnessing India’s digital economy through data localisation.
• India has the second-highest fintech adoption rate in the world, creating multiple opportunities for payments companies — both national and international. This also translates into a growing volume of user and transaction data, coupled with the challenges of data breach and fraud.
• The Indian government is of the view that if data is stored outside the sovereign boundaries of the country, the RBI’s ability to “monitor payments activity” is curtailed.
• India’s law enforcement agencies security agencies are backing the RBI’s push for data localisation owing to difficulties in carrying out cross-border probes.

Issue over Data Localisation :- 

Global Companies’ Stand :- 
Global corporations such as Pay-Pal, Visa and Mastercard along with payment service providers like Google and Amazon have sought more time and have also asked to be allowed to mirror the data. According to them:

• Regulators should understand the value of free flow of data, thereby indicating stringent localisation norms could affect innovation and ease of doing business in India.
• Localization would lead to a larger presence in India overall, such as local offices, and increase tax liability.
• It may backfire on India’s own young start-ups that are attempting global growth, or on larger firms that process foreign data in India, such as Tata Consulting Services and Wipro.
• Global payment players will have to increase their investments in the country, both on infrastructure and on timely execution.

Domestic Companies’ Stand :- 
Domestic companies like Paytm and PhonePe came out strongly in support of data localization. According to them:

• Data localisation is important for national security.
• Global companies are worried that the monetisation potential through the data.
• generated reduces drastically and they also become more accountable in India.
• Primary data storing and processing should be in India but mirroring can be allowed for global remittance companies as long as only the copy is kept outside.
• It would allow for better regulatory oversight and plug business jurisdiction related loopholes that some foreign companies have long exploited to evade paying fair taxes in India.

Data Localization in Other Countries :- 

• Russia: It has the most restrictive regulation for data flow with strict localisation and high penalties.
• China: It mandates localisation for all “important data” held by “critical information infrastructure” and any cross border personal data transfer must undergo a security assessment.
• US: It leaves regulation up to the state and sector. Earlier this year, it signed the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) which established data sharing with certain countries.
• EU: The European Union's General Data Protection Regulation doesn't have a specific data regulation rule, only stressing that cross-border data movement can happen if the other country has stringent rules to secure information.

Challenges in Data Localisation :-

• Misuse of Data: Critics not only caution against state misuse and surveillance of personal data, but also argue that security and government access is not achieved by localisation. Even if the data is stored in the country, the encryption keys may still remain out of the reach of national agencies.
• Cyber Security: Businesses in India were most at risk to cyber security attacks. This can put data of citizens in danger.
• Increase of conflicts: This may be perceived as a protectionist policy which may lead to other countries following suit and increased conflict over data sharing.
• Access to data: Technology experts argues that the physical location of data is irrelevant. Data can be accessed from a server in Bengaluru or Boston just as easily. In fact, having a mirror of data in India may actually increase the cost of operation and compliance.
• Cloud Computing Softwares: Cloud computing softwares have taken advantage of the economies of scale and an infrastructural architecture across the world. Thus, when there is a threat presumed in one part of the world, the algorithm would move the data to another location or even in multiple locations. However, this flexibility may be hampered due to data localization.

Future of Data Localisation in India: A Balanced Approach :- 

• Data localisation rules are not motivated by a single national or private interest. Various simultaneous factors contribute to national strategies on restricting cross-border data flows or establishing controls for transfer of information.
• Technological sovereignty goes beyond the idea of economic competition and builds on the idea that advancements in the technological capacity of one nation threaten the national sovereignty of another. This stems from the growing perception that nations that are able to localise technological development and control data flows will fare better in the Internet governance order.
• Data localisation or restrictions on movement of data are primarily understood in terms of their economic value or as a geopolitical strategy that helps nations consolidating information security and sovereignty online. However, it is equally important to think about the consequences of such policies on democracy and human rights particularly in this time of growing public debate about the use and commercialisation of individual data.